Buggy code:
public class Ajp13 { public static final int MAX_PACKET_SIZE = 8192 ; public static final int H_SIZE = 4 ; public static final int MAX_READ_SIZE = ( ( Ajp13 . MAX_PACKET_SIZE ) - ( Ajp13 . H_SIZE ) ) - 2 ; public static final int MAX_SEND_SIZE = ( ( Ajp13 . MAX_PACKET_SIZE ) - ( Ajp13 . H_SIZE ) ) - 4 ; public static final byte JK_AJP13_FORWARD_REQUEST = 2 ; public static final byte JK_AJP13_SHUTDOWN = 7 ; public static final byte JK_AJP13_SEND_BODY_CHUNK = 3 ; public static final byte JK_AJP13_SEND_HEADERS = 4 ; public static final byte JK_AJP13_END_RESPONSE = 5 ; public static final int SC_RESP_CONTENT_TYPE = 40961 ; public static final int SC_RESP_CONTENT_LANGUAGE = 40962 ; public static final int SC_RESP_CONTENT_LENGTH = 40963 ; public static final int SC_RESP_DATE = 40964 ; public static final int SC_RESP_LAST_MODIFIED = 40965 ; public static final int SC_RESP_LOCATION = 40966 ; public static final int SC_RESP_SET_COOKIE = 40967 ; public static final int SC_RESP_SET_COOKIE2 = 40968 ; public static final int SC_RESP_SERVLET_ENGINE = 40969 ; public static final int SC_RESP_STATUS = 40970 ; public static final int SC_RESP_WWW_AUTHENTICATE = 40971 ; public static final byte JK_AJP13_GET_BODY_CHUNK = 6 ; public static final byte SC_A_CONTEXT = 1 ; public static final byte SC_A_SERVLET_PATH = 2 ; public static final byte SC_A_REMOTE_USER = 3 ; public static final byte SC_A_AUTH_TYPE = 4 ; public static final byte SC_A_QUERY_STRING = 5 ; public static final byte SC_A_JVM_ROUTE = 6 ; public static final byte SC_A_SSL_CERT = 7 ; public static final byte SC_A_SSL_CIPHER = 8 ; public static final byte SC_A_SSL_SESSION = 9 ; public static final byte SC_A_REQ_ATTRIBUTE = 10 ; public static final byte SC_A_ARE_DONE = ( ( byte ) ( 255 ) ) ; public static final String [ ] methodTransArray = new String [ ] { "OPTIONS" , "GET" , "HEAD" , "POST" , "PUT" , "DELETE" , "TRACE" } ; public static final String [ ] headerTransArray = new String [ ] { "accept" , "accept-charset" , "accept-encoding" , "accept-language" , "authorization" , "connection" , "content-type" , "content-length" , "cookie" , "cookie2" , "host" , "pragma" , "referer" , "user-agent" } ; OutputStream out ; InputStream in ; Ajp13 . Ajp13Packet outBuf = new Ajp13 . Ajp13Packet ( Ajp13 . MAX_PACKET_SIZE ) ; Ajp13 . Ajp13Packet inBuf = new Ajp13 . Ajp13Packet ( Ajp13 . MAX_PACKET_SIZE ) ; byte [ ] bodyBuff = new byte [ Ajp13 . MAX_READ_SIZE ] ; int blen ; int pos ; public Ajp13 ( ) { } public void setSocket ( Socket socket ) throws IOException { } public int receiveNextRequest ( Request req ) throws IOException { } private int decodeRequest ( Request req , Ajp13 . Ajp13Packet msg ) throws IOException { } public int doRead ( ) throws IOException { <START_BUG> if ( ( pos ) > ( blen ) ) { <END_BUG> refeelReadBuffer ( ) ; } return bodyBuff [ ( ( pos ) ++ ) ] ; } public int doRead ( byte [ ] b , int off , int len ) throws IOException { } public void recycle ( ) { } public void refeelReadBuffer ( ) throws IOException { } public void sendHeaders ( int status , MimeHeaders headers ) throws IOException { } public void finish ( ) throws IOException { } protected int headerNameToSc ( String name ) { } public void doWrite ( byte [ ] b , int off , int len ) throws IOException { } public int receive ( Ajp13 . Ajp13Packet msg ) throws IOException { } public void send ( Ajp13 . Ajp13Packet msg ) throws IOException { } public void close ( ) throws IOException { } public static class Ajp13Packet { byte [ ] buff ; int len ; int pos ; int maxlen ; public Ajp13Packet ( int size ) { } public Ajp13Packet ( byte [ ] b ) { } public byte [ ] getBuff ( ) { } public void setBuff ( byte [ ] b ) { } public int getLen ( ) { } public int getMaxLen ( ) { } public int checkIn ( ) { } public void reset ( ) { } public void end ( ) { } public void setInt ( int bpos , int val ) { } public void appendByte ( byte val ) { } public void appendInt ( int val ) { } public void appendString ( String val ) { } public void appendBytes ( byte [ ] b , int off , int len ) { } public int getInt ( ) { } public int peekInt ( ) { } public byte getByte ( ) { } public byte peekByte ( ) { } public String getString ( ) throws UnsupportedEncodingException { } public int getBytes ( byte [ ] dest ) { } private String hex ( int x ) { } private void hexLine ( int start ) { } public void dump ( String msg ) { } } }

Fix:
if ( ( pos ) >= ( blen ) ) {